Analyze Network Traffic with Wireshark

Capture, filter, and interpret network packets to find security risks.

Introduction

30 Second Summary

Every time you browse a website, send an email, or stream a video, your computer sends and receives thousands of tiny data packets across the network. Understanding what those packets contain is the foundation of cybersecurity defense.

In this project, you will use Wireshark to capture live network traffic from your Windows machine, filter packets by protocol, and identify real security vulnerabilities like exposed browsing history and plaintext credentials.

What You'll Build

A series of network traffic captures and analyses that demonstrate core skills tested on CompTIA Security+ (SY0-701 Domain 4: Security Operations) and CEH v13 (Module 8: Sniffing).

By the end of this project, you'll have:

A saved .pcap file of your own live network traffic captured from your machine.
Filtered views isolating DNS, TCP, and HTTP protocols using Wireshark's display filters.
A reconstructed HTTP conversation showing plaintext data exposure via Follow TCP Stream.
Secret Mission: detect a port scan by installing Nmap and identifying SYN flood signatures in Wireshark.

Are there any prerequisites?

This project assumes a basic understanding of IP addresses, ports, and protocols (like knowing that port 443 is for HTTPS). You do not need any prior experience with Wireshark or packet analysis.

Install Wireshark

Before you can capture and analyze network traffic, you need a tool that can tap into the data flowing through your network interface.

In this step, you will install Wireshark on your Windows machine along with Npcap, the driver that enables live packet capture.

In this step, get ready to:

Install Wireshark with Npcap on your Windows machine.
Verify the installation shows active network interfaces.
Identify your active network interface for capturing.

Download and install Wireshark

Open your web browser and navigate to the Wireshark download page:

https://www.wireshark.org/download.html

Click the Windows x64 Installer link under the Stable Release section to download Wireshark-4.6.6-x64.exe.
Once downloaded, double-click the installer file to launch the setup wizard.
Click Next through each screen, keeping the default settings.
When you reach the Npcap installation step, ensure the Install Npcap box remains checked.

What is Npcap?

Npcap is the packet capture driver for Windows. It allows Wireshark to intercept network traffic passing through your network interfaces in real-time.

Without Npcap, Wireshark can only open previously saved capture files. It cannot perform live captures.

A separate Npcap installer window will appear during the process. Accept its default settings and click Install.
After Npcap finishes, click Next to continue the Wireshark setup.
Click Finish to complete the installation.

Installer won't run?

If Windows blocks the installer with a SmartScreen warning, click More info and then Run anyway. The official Wireshark installer is signed by the Wireshark Foundation.

help me troubleshoot why the Wireshark installer is being blocked on Windows

Verify the installation

Press the Windows key to open your search bar.
Type Wireshark and press Enter to open it.

You should see the Wireshark Welcome screen with a list of network interfaces (e.g., Wi-Fi, Ethernet).

Confirm that at least one interface shows a small activity sparkline next to its name.

These sparklines indicate that Wireshark is detecting live traffic on your network adapters.

✔️ I see interfaces with sparklines

Wireshark and Npcap are installed correctly. You are ready to identify your active interface.

ⓧ I see interfaces but no sparklines

Sparklines may take a few seconds to appear. Wait 5-10 seconds and check again.

If sparklines still do not appear, Npcap may not have installed correctly. Close Wireshark, then download and install Npcap manually from https://npcap.com/. Reopen Wireshark after the install completes.

ⓧ Wireshark won't open or shows no interfaces

This usually means Npcap was skipped during installation. Close Wireshark if it opened.

Download Npcap separately from https://npcap.com/.
Run the Npcap installer with default settings.
Reopen Wireshark and confirm interfaces now appear.

help me fix Wireshark not detecting any network interfaces on Windows

Identify your active interface

Your machine has multiple network interfaces, but only one is actively carrying your internet traffic. You need to identify which one to capture from.

Look at the sparklines next to each interface name on the Welcome screen.
Find the interface with the most activity on its sparkline. This is your active internet connection.
Note the interface name. It is typically Wi-Fi or Ethernet, depending on how you connect to the internet.

Wired vs wireless

If you are connected via a cable, look for Ethernet. If you are on Wi-Fi, look for Wi-Fi. The busiest sparkline confirms which one carries your traffic.

Your Wireshark installation is ready to go. Next up, you will use this active interface to capture live network traffic from your machine.

Capture Live Network Traffic

Wireshark is installed and ready to listen. Now it's time to capture real network traffic flowing through your machine.

Every time you visit a website, your computer sends and receives dozens of packets. In this step, you'll capture those packets, explore what they reveal about your network activity, and save the capture for later analysis.

In this step, get ready to:

Start a live packet capture on your active network interface.
Navigate Wireshark's three-pane interface to inspect individual packets.
Save your capture as a .pcapng file for later analysis.

Start a live capture

Your active network interface is already visible on the Wireshark Welcome screen. Double-clicking it tells Wireshark to start recording every packet that crosses that connection.

Double-click your active network interface (the one with the most sparkline activity) on the Welcome screen.
Observe packets appearing in real-time in the top section of the Wireshark window.
Open a web browser and visit 2-3 different websites to generate traffic.
Wait 15-20 seconds, then press Ctrl+E to stop the capture.

What just happened?

While the capture was running, Wireshark recorded every single packet your computer sent or received. Each website visit generated dozens of packets for DNS lookups, TCP connections, and encrypted TLS data transfers.

You should now see hundreds of rows in the top pane, each representing one packet. The Protocol column shows the mix of protocols your machine used.

No packets appearing?

If the packet list stays empty after double-clicking the interface, you may have selected an inactive adapter. Close the capture by pressing Ctrl+E, return to the Welcome screen, and double-click the interface with the tallest sparkline instead.

If no interfaces show any activity at all, Npcap may not have installed correctly. Reinstall Wireshark and ensure the Install Npcap checkbox remains checked during setup.

Help me figure out why Wireshark isn't capturing any packets.

Navigate the three-pane interface

Wireshark splits captured data across three panes so you can drill down from a high-level summary all the way to raw bytes.

Click on any packet in the top section (the Packet List pane). Each row shows one packet with columns for time, source IP, destination IP, protocol, length, and info.
Look at the middle section (the Packet Details pane). This shows the selected packet's protocol layers expanded in a tree you can click to drill into.
Look at the bottom section (the Packet Bytes pane). This shows the raw hexadecimal and ASCII representation of the selected packet.
In the Packet Details pane, click the triangle next to each protocol layer (Ethernet, Internet Protocol, TCP or UDP) to expand and collapse them.

What do the three panes show?

The Packet List pane (top) is your overview. Selecting any row here drives what appears in the other two panes.

The Packet Details pane (middle) reveals protocol layers stacked inside the packet, from the lowest (Ethernet) to the highest (the application protocol like DNS or TLS).

The Packet Bytes pane (bottom) shows exactly what traveled over the wire. Clicking a field in the Details pane highlights its corresponding bytes below.

Save your capture

Saving your capture lets you reopen and analyze the same traffic later without needing to recapture it.

Click File in the menu bar at the top of the Wireshark window.
Click Save As.
Navigate to your Desktop in the save dialog.
Enter my_first_capture.pcapng as the file name.
Click Save.

What is a .pcapng file?

The .pcapng format (Packet Capture Next Generation) is Wireshark's default save format. It stores every packet exactly as it was captured, along with timestamps and interface metadata.

You can reopen this file at any time to re-analyze the same traffic, apply new filters, or share it with a colleague for review.

Confirm my_first_capture.pcapng appears on your Desktop.
In the Wireshark Packet List pane, look at the Protocol column. You should see a mix of protocols including DNS, TCP, TLS, and possibly others.

Don't see different protocols in the Protocol column?

If all packets show only one protocol (like TCP), you may not have generated enough traffic. Try starting a new capture, visiting several different websites, and waiting a few extra seconds before stopping.

If the file did not save, check that you selected your Desktop as the save location and that the file name ends with .pcapng.

Help me troubleshoot my Wireshark capture.

You have your first real packet capture saved and ready for analysis. Next up, you'll learn how to use display filters to slice through hundreds of packets and isolate exactly the traffic you care about.

Master Display Filters

You have a saved capture file full of network traffic. The problem is that a typical capture contains hundreds or thousands of packets from dozens of protocols, all mixed together.

Display filters let you slice through this noise by showing only the packets you care about. In this step, you will learn the filter syntax that both Security+ and CEH exams expect you to know.

In this step, get ready to:

Filter packets by protocol (DNS, TCP, HTTP).
Isolate traffic by IP address and port number.
Combine filters with logical operators to find specific patterns.

Filter by protocol

The display filter bar sits at the top of the Wireshark window. It validates your filter as you type. The bar turns green when your filter syntax is valid and red when it contains an error.

Make sure my_first_capture.pcapng is open in Wireshark. If you closed it, reopen it via File > Open and select the file from your Desktop.
Click inside the display filter bar at the top of the window.
Type dns and press Enter.

The Packet List pane now shows only DNS query and response packets. Look at the Info column. Each row reveals a domain name your machine looked up.

Clear the filter by clicking the X button at the right end of the filter bar.
Type tcp and press Enter to see only TCP packets.
Clear the filter again, then type http and press Enter to see HTTP packets.

Why might you see few or no HTTP packets?

Most modern websites use HTTPS (encrypted HTTP over TLS). Wireshark classifies that traffic as TLS rather than http. This is actually a security win. It means the actual content of your web browsing is encrypted.

In Step 4, you will open a sample capture file that contains plaintext HTTP traffic so you can see what unencrypted web requests look like.

Filter bar turned red?

A red background means Wireshark does not recognize your filter. Check for typos. The filter must be lowercase (dns not DNS). Make sure there are no extra spaces before or after the filter text.

Why isn't my Wireshark display filter working?

Filter by IP address and port

Protocol filters are broad. To narrow your view to traffic involving a specific server, you can filter by IP address or port number.

Clear any active filter by clicking the X button.
Look at the Destination column in the Packet List pane and pick any IP address you see (for example, 142.250.80.46).
Type ip.addr == followed by the IP address you picked (e.g., ip.addr == 142.250.80.46) and press Enter.

The Packet List now shows only packets to and from that specific server.

Clear the filter, then type tcp.port == 443 and press Enter.

What does tcp.port == 443 show?

Port 443 is the standard port for HTTPS traffic. This filter shows every encrypted web connection your machine made. Since most sites use HTTPS, this filter typically returns the majority of your capture.

No results after filtering by IP?

Double-check that you copied the IP address exactly as it appears in the Destination column. The == operator requires an exact match. Also confirm there is a space on both sides of ==.

Help me fix my Wireshark IP address filter

Combine filters with logical operators

Real network analysis requires combining conditions. Wireshark uses && (AND) to chain filters together so only packets matching all conditions appear.

Clear any active filter.
Type dns && ip.addr == 8.8.8.8 and press Enter.

This shows only DNS queries sent to Google's public DNS server (8.8.8.8). You may see results here if your machine uses Google DNS. If not, the list will be empty.

Clear the filter, then type tcp.flags.syn == 1 && tcp.flags.ack == 0 and press Enter.

What are SYN packets?

Every TCP connection starts with a SYN (synchronize) packet. This filter shows only those initial connection attempts. Each row represents your machine reaching out to a server for the first time in that connection.

This pattern matters for security. A flood of SYN packets to many different ports on one destination is the signature of a port scan. You will explore this further in the Secret Mission.

Quick-clear shortcut

Instead of clicking the X button every time, you can select all text in the filter bar with Ctrl+A, then press Delete and Enter to clear and reset the view.

You can now slice through a packet capture with precision. Next up, you will open a sample capture file containing real HTTP traffic and dissect a full web request and response conversation.

Analyze HTTP Traffic from a Sample Capture

You now know how to filter packets by protocol, IP address, and TCP flags. The next challenge is reading what those packets actually contain.

Most modern websites use HTTPS, which encrypts traffic so you cannot read it in Wireshark. To practice reading real HTTP headers and payloads, you will open an official Wireshark sample capture that contains plaintext HTTP traffic.

In this step, get ready to:

Download an official Wireshark sample capture file containing HTTP traffic.
Dissect an HTTP request and response to identify key headers.
Reconstruct a full HTTP conversation using Follow TCP Stream.

Download the official sample capture

Wireshark maintains a public wiki page with sample capture files for learning and testing. You will download a small file that contains a simple HTTP request and response.

Open your web browser and navigate to the Wireshark Sample Captures page:
https://wiki.wireshark.org/SampleCaptures
Scroll down to the HyperText Transport Protocol (HTTP) section.
Find the file named http.cap (described as "A simple HTTP request and response").
Click the http.cap link to download it. Save it somewhere easy to find, like your Desktop.

Now open the file in Wireshark.

Switch back to Wireshark.
Click File in the top menu bar.
Click Open.
Navigate to where you saved http.cap and select it.
Click Open.

You should see a small number of packets loaded in the Packet List pane. This file is intentionally tiny so you can focus on the HTTP conversation without noise.

Don't see the file in the Open dialog?

Make sure the file type filter at the bottom of the dialog is set to show all capture files. If you still cannot find it, check your browser's Downloads folder instead of the Desktop.

help me find my downloaded http.cap file in Wireshark

Dissect the HTTP request and response

With http.cap open, you can now isolate the HTTP packets and inspect their headers layer by layer.

Click the display filter bar (the green bar at the top of the Wireshark window).
Type http and press Enter.
Only the HTTP packets are now visible. You should see a GET request and a response.

Inspect the HTTP GET request first.

Click on the packet that shows GET in the Info column.
In the Packet Details pane (middle section), find and click the triangle next to Hypertext Transfer Protocol to expand it.
Identify the request method (GET), the Host header, and the requested URI.

What am I looking at?

The Packet Details pane shows each protocol layer from bottom (physical) to top (application). The Hypertext Transfer Protocol section is the application layer, where you can read the actual HTTP headers your browser would normally send to a web server.

The request method tells the server what action to perform. The Host header names the server. The URI identifies the specific resource being requested.

Now inspect the HTTP response.

Click on the packet whose Info column shows a response (look for 200 OK or similar status code).
Expand Hypertext Transfer Protocol in the Packet Details pane.
Identify the status code (e.g., 200 OK), the content type, and the content length.

What do these response headers mean?

The status code tells the client whether the request succeeded (200 means success). The content type describes what format the response body uses (like text/html). The content length states how many bytes the response body contains.

Only seeing one packet after filtering?

Make sure you typed http (lowercase) in the filter bar, not HTTP. Display filters are case-sensitive. If the filter bar turns red, the filter syntax is invalid.

help me fix my Wireshark display filter for HTTP traffic

Reconstruct the full conversation

Wireshark can reassemble all the packets in a TCP connection and display them as a continuous readable conversation. This is called Follow TCP Stream.

Right-click on any HTTP packet in the Packet List pane.
Hover over Follow in the context menu.
Click TCP Stream.

A new window opens showing the entire HTTP conversation in readable text. The request appears in red and the response appears in blue.

Why does this matter for security?

Everything you see in this window was sent over the network in plaintext. Anyone on the same network running Wireshark could read this conversation, including URLs, headers, and any form data submitted over HTTP.

This is precisely why HTTPS exists. Encrypted connections prevent this kind of passive eavesdropping. Any website still using plain HTTP exposes its users to traffic interception.

Read through the conversation. Notice how you can see the full request line, all headers, and the complete response body.
Close the TCP Stream window by clicking Close at the bottom.

You have now dissected a real HTTP conversation and seen exactly what a network eavesdropper could read. Next up, you will return to your own capture and identify security-relevant patterns hiding in your live traffic.

Identify Security Indicators in Your Capture

You have dissected HTTP traffic and reconstructed a full plaintext conversation using Follow TCP Stream. Now you know exactly what unencrypted traffic reveals to anyone listening.

In this step, you will turn that knowledge inward and examine your own live capture for security-relevant patterns. You will uncover how DNS queries expose your browsing history, how TCP handshakes reveal connection behaviour, and how plaintext protocols put credentials at risk.

In this step, get ready to:

Expose DNS browsing history in your capture.
Identify a TCP three-way handshake pattern.
Search for plaintext credential exposure.

Expose your DNS browsing history

Every website you visit requires a DNS lookup first. These lookups travel in plaintext, even when the website itself uses HTTPS.

In Wireshark, go to File > Open and select your my_first_capture.pcapng file from your Desktop.
Click in the display filter bar (the green bar at the top of the window).
Type the following filter and press Enter:

dns.qr == 0

Read the Info column in the Packet List pane.
Each row displays a domain name your machine looked up, such as www.google.com or cdn.example.net.

What does this filter reveal?

The filter dns.qr == 0 isolates only DNS queries (outbound lookups from your machine). It hides the DNS responses so you see a clean list of every domain your computer requested.

This is a key security insight. Anyone capturing traffic on the same network can read your entire browsing history from DNS queries alone, even when the websites themselves use HTTPS encryption.

Not seeing any DNS packets?

Make sure you opened my_first_capture.pcapng (not http.cap). The sample file may not contain DNS traffic.

If your own capture also shows no DNS, your capture may have been too short. Try starting a new capture, visiting a few websites, stopping after 15-20 seconds, and checking again.

Help me troubleshoot missing DNS packets in my Wireshark capture.

Analyze a TCP three-way handshake

Every TCP connection starts with a three-way handshake: SYN, SYN-ACK, ACK. Recognizing this pattern helps you spot both normal connections and suspicious scanning activity.

Clear the current filter by clicking the X button on the right side of the filter bar.
Type the following filter and press Enter to show only TCP SYN packets (connection initiation attempts):

tcp.flags.syn == 1

Pick any SYN packet from the list.
Note the destination IP address from the Destination column.
In the Packet Details pane (middle section), expand Transmission Control Protocol and note the Dst Port value.
Clear the filter and type the following, replacing the IP and port with the values you noted:

ip.addr == [[DEST_IP="destination IP from your SYN packet"]] && tcp.port == [[DEST_PORT="destination port from your SYN packet"]]

Press Enter to apply the filter.
Look at the first three packets in the filtered results. You should see the three-way handshake pattern:

SYN (your machine to the server).
SYN-ACK (server back to you).
ACK (your machine confirming).

Why does this matter for security?

Each SYN packet represents your machine attempting to open a connection to a server. In normal traffic, you will see a handful of SYN packets to various destinations as your browser loads pages.

A flood of SYN packets sent to many different ports on one destination is a port scan signature. This is exactly what network intrusion detection systems watch for.

Only seeing SYN packets with no SYN-ACK response?

Some SYN packets may not have a matching SYN-ACK if the destination server did not respond. Try a different SYN packet that targets port 443 (HTTPS). Connections to major websites on port 443 almost always complete the full handshake.

Help me find a complete TCP three-way handshake in my capture.

Check for plaintext data exposure

Any traffic sent over unencrypted protocols is readable by anyone on the same network. This final check searches your capture for protocols that transmit data in plaintext and looks for credential-related strings.

Clear the current filter by clicking the X button.
Type the following filter to search for any unencrypted protocols and press Enter:

http || ftp || telnet

If any packets appear, note what information is visible in the Info column (URLs, file names, or form data).
Now search for credential-related strings across all traffic by typing this filter and pressing Enter:

frame contains "password"

If no results appear, try this alternative search:

frame contains "login"

Note any matches that appear. If neither filter returns results, that is a good sign. It means no credentials were sent in plaintext during your capture.

What is the security risk here?

Any HTTP form submission (like a login page without HTTPS) transmits usernames and passwords in plaintext. Anyone running Wireshark on the same network could read those credentials directly.

The frame contains filter searches the raw bytes of every packet for a specific string. This is how security analysts hunt for sensitive data leaking across a network.

Most sites use HTTPS now

You may see few or no results from the http || ftp || telnet filter. That is expected. Most modern websites encrypt their traffic with TLS. This is exactly why encrypted protocols exist: to prevent the plaintext exposure you saw in the http.cap sample.

Filter bar turned yellow or red?

A yellow filter bar means the filter syntax is valid but incomplete. A red bar means there is a syntax error. Double-check that the quotes around "password" or "login" are straight double quotes, not curly quotes.

Help me fix my Wireshark display filter syntax error.

Secret mission

Detect a Port Scan

You've learned to spot SYN packets that initiate connections. But what does it look like when an attacker sends hundreds of them in seconds? Install Nmap and launch a real port scan against your own machine to see the signature that intrusion detection systems are built to catch.

Clean Up Your Resources

This project runs entirely on your local machine. There are no cloud resources, no ongoing costs, and no subscriptions to cancel.

Decide whether to keep your tools and capture files for future practice, or remove them entirely.

Resources you used:

my_first_capture.pcapng (saved on your Desktop).
http.cap (downloaded sample file, stored locally).
Wireshark 4.6.6 (installed application with Npcap driver).
Nmap (installed for the Secret Mission).

Keep everything running

No action needed. Choose this if you plan to continue practicing packet analysis or want Wireshark available for future projects.

Your capture files remain on your Desktop and in your Downloads folder.
Wireshark, Npcap, and Nmap stay installed and ready to use whenever you need them.

Pause - I'll come back to this later

There are no running processes or background services to stop. Wireshark and Nmap only run when you open them manually.

Close Wireshark if it is still open. If prompted to save your current capture, choose whether to keep it or discard it.
Your saved .pcapng and .cap files remain on disk for when you return.

Delete - I don't want to use this again

Remove all project files and uninstall the tools you installed during this project.

Delete your capture files by opening Command Prompt and running:

del "%USERPROFILE%\Desktop\my_first_capture.pcapng"

Delete the http.cap file from your Downloads folder (or wherever you saved it).
Uninstall Nmap by opening the Control Panel.
Select Add or Remove Programs (or Programs and Features on older Windows versions).
Find Nmap in the list, select it, and click Remove.
Uninstall Wireshark by finding Wireshark in the same list and clicking Uninstall.
Uninstall Npcap separately. Find Npcap in Programs and Features and click Uninstall. The Wireshark uninstaller does not remove Npcap automatically.

Nice Work!

You just captured, filtered, and analyzed real network traffic with Wireshark. These are core skills tested directly on CompTIA Security+ (SY0-701 Domain 4) and CEH v13 (Module 8).

You've learned how to:

Captured live network traffic and navigated the three-pane interface (Packet List, Packet Details, Packet Bytes) to inspect individual packets down to their raw bytes.
Applied display filters to isolate traffic by protocol (DNS, TCP, HTTP), IP address, port, and TCP flags, and reconstructed a full HTTP conversation using Follow TCP Stream.
Identified real security indicators including DNS browsing history exposure, TCP three-way handshake patterns, and plaintext credential risk in unencrypted protocols.
Secret Mission: Detected a port scan by identifying the SYN flood signature using Nmap and Wireshark together.

Ready to quiz yourself?